Latest pimcore pimcore Vulnerabilities

● CVE-2023-49076
Pimcore missing token/header to prevent CSRF
Pimcore Pimcore<4.0.5
● CVE-2023-47637
SQL Injection in Admin Grid Filter API in Pimcore
composer/pimcore/pimcore<11.1.1
Pimcore Pimcore<11.1.1
● CVE-2023-5873
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Pimcore Pimcore<11.1.0
composer/pimcore/pimcore<11.1.0
● CVE-2023-4453
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.
Pimcore Pimcore<10.6.8
composer/pimcore/pimcore<10.6.8
● CVE-2023-38708
Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `AssetController::importServerFilesAction`...
composer/pimcore/pimcore<10.6.7
Pimcore Pimcore<10.6.7
● CVE-2023-3820
SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.
Pimcore Pimcore<10.6.4
composer/pimcore/pimcore<10.6.4
● CVE-2023-3819
### Impact Unauthorized users are able to obtain sensitive information about the system's runtime environment, features they have no permissions to access, etc. ### Patches Update to version 10.6.4 o...
Pimcore Pimcore<10.6.4
composer/pimcore/pimcore<10.6.4
● CVE-2023-3821
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.
Pimcore Pimcore<10.6.4
● CVE-2023-3822
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.4.
Pimcore Pimcore<10.6.4
● CVE-2023-3673
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.24.
Pimcore Pimcore<10.5.24
composer/pimcore/pimcore<10.5.24
● CVE-2023-2983
Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.
Pimcore Pimcore<10.5.23
● CVE-2023-2984
Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.
Pimcore Pimcore<10.5.22
Microsoft Windows
● CVE-2023-2730
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.
Pimcore Pimcore<10.3.3
composer/pimcore/pimcore<10.3.3
● CVE-2023-2630
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
Pimcore Pimcore<10.5.21
composer/pimcore/pimcore<10.5.21
● CVE-2023-2615
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
Pimcore Pimcore<10.5.21
● CVE-2023-2614
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
Pimcore Pimcore<10.5.21
● CVE-2023-2616
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
Pimcore Pimcore<10.5.21
● CVE-2023-30855
Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. The impact of this path traversal and arbitrary extension is l...
Pimcore Pimcore<10.5.18
composer/pimcore/pimcore<10.5.18
● CVE-2023-2361
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
Pimcore Pimcore<10.5.21
composer/pimcore/pimcore<10.5.21
● CVE-2023-30852
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vu...
Pimcore Pimcore<10.5.21
composer/pimcore/pimcore<10.5.21
● CVE-2023-30850
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the admin translations API. Users should update to version 10.5.21 ...
Pimcore Pimcore<10.5.21
composer/pimcore/pimcore<10.5.21
● CVE-2023-30849
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the translation export API. Users should update to version 10.5.21 ...
Pimcore Pimcore<10.5.21
composer/pimcore/pimcore<10.5.21
● CVE-2023-30848
Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection vulnerability. Users should upgrade to version 10.5.21 to rec...
Pimcore Pimcore<10.5.21
composer/pimcore/pimcore<10.5.21
● CVE-2023-2343
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
Pimcore Pimcore<10.5.21
● CVE-2023-2341
### Impact Malicious JavaScript has access to all the same objects as the rest of the web page, including access to cookies and local storage, which are often used to store session tokens. If an attac...
composer/pimcore/pimcore<10.5.21
Pimcore Pimcore<10.5.21
● CVE-2023-2342
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
composer/pimcore/pimcore<10.5.21
Pimcore Pimcore<10.5.21
● CVE-2023-2340
### Impact The attacker is capable to stolen the user session cookie. it will leads to complete account takeover. ### Patches Update to version 10.5.21 or apply this patch manually https://github.com...
composer/pimcore/pimcore<10.5.21
Pimcore Pimcore<10.5.21
● CVE-2023-2339
### Impact Stored cross site scripting vulnerability in operator any getter in dataobject grid configuration. ### Patches Update to version 10.5.21 or apply this patch manually https://github.com/pim...
Pimcore Pimcore<10.5.21
● CVE-2023-2338
### Impact SQL injections in AssetController due to unsanitized concatenating strings in where clause. The attacker can dump database, alter data or perform dos on the backend database. ### Patches U...
composer/pimcore/pimcore<10.5.21
Pimcore Pimcore<10.5.21
● CVE-2023-2336
Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.
Pimcore Pimcore<10.5.21
● CVE-2023-2327
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
Pimcore Pimcore<10.5.21
composer/pimcore/pimcore<10.5.21
● CVE-2023-2328
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.
Pimcore Pimcore<10.5.21
composer/pimcore/pimcore<10.5.21
● CVE-2023-2323
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
Pimcore Pimcore<10.5.21
composer/pimcore/pimcore<10.5.21
● CVE-2023-2322
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.
Pimcore Pimcore<10.5.21
composer/pimcore/pimcore<10.5.21
● CVE-2023-1704
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.
Pimcore Pimcore<10.5.20
● CVE-2023-1703
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
Pimcore Pimcore<10.5.20
● CVE-2023-1701
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.
Pimcore Pimcore<10.5.20
● CVE-2023-1702
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
Pimcore Pimcore<10.5.20
● CVE-2023-28438
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this ...
Pimcore Pimcore<10.5.19
● CVE-2023-1578
SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19.
Pimcore Pimcore<10.5.19
● CVE-2023-1517
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19.
Pimcore Pimcore<10.5.19
● CVE-2023-28429
Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to ste...
Pimcore Pimcore<10.5.19
● CVE-2023-1515
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
Pimcore Pimcore<10.5.19
● CVE-2023-28108
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL i...
Pimcore Pimcore<10.5.19
● CVE-2023-28106
Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgr...
Pimcore Pimcore<10.5.19
● CVE-2023-1429
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
Pimcore Pimcore<10.5.19
● CVE-2023-1312
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
Pimcore Pimcore<10.5.19
● CVE-2023-1286
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
Pimcore Pimcore<10.5.19
● CVE-2023-1117
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Pimcore Pimcore<10.5.18
● CVE-2023-1115
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.
Pimcore Pimcore<10.5.18

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203